When a mail client, such as Outlook, accesses messages, FPE provides real-time protection by means of the Exchange VSAPI plug-in. It intercepts and routes messages to an FPE scanning process for malware scanning and filtering.

A message in the mailbox database can be scanned in the following ways:

Realtime scanning—Scans messages when they are accessed. Access can include opening a message with a client application, viewing it in a preview pane, and performing content-indexing operations. By default this option is enabled.

Scheduled scanning—Scans messages based on a set schedule or can be run immediately as needed. Scheduled scans are typically used to scan the entire information store. This option must be configured and enabled. To configure scheduled scanning, see Scheduling malware scanning of mailboxes and public folders.

Tip:

It is a recommended best practice to run a full, scheduled scan, during off hours in order to conserve resources, after installing FPE.